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We develop a new method to quantify the secret key rate for permutation-invariant protocols for 
coherent attacks and finite resources. The method reduces the calculation of secret key rates for 
coherent attacks to the calculation for collective attacks by bounding the smooth min-entropy of 
permutation-invariant states via the smooth min-entropy of corresponding tensor-product states. 
The comparison of the results to the well-known post-selection technique for the BB84 and six-state 
protocol shows the high relevance of this method. Since our calculation of secret key rates for 
coherent attacks strongly depends on the way of treating collective attacks, a prospective progress 
in the analysis of collective attacks will immediately cause progress in our strategy. 



I. INTRODUCTION 

The aim of quantum key distribution (QKD) is the 
generation of a secret key between two authorized par- 
ties Alice and Bob in the presence of an eavesdropper 
Eve. In practical implementations the number of signals 
used to establish a secure key is finite. An essential ele- 
ment of the calculation of key rates for a finite number 
of signals is the evaluation of the smooth min-entropy 
1] for high-dimensional states, which is in general hard 
or even impossible to compute. In the last years many 
results have appeared pHIll considering the calculation 
of secret key rates for finite resources under the restric- 
tion of the eavesdropper's attack to a collective attack 
[HI, where Eve interacts with each signal indepen- 
dently and identically. This restriction leads to a state, 
which has tensor-product form and allows to bound the 
smooth min-entropy by the conditional von Neumann 
entropy of a single-signal state by using the asymptotic 
equipartition property (AEP) [j ], 

In studies of coherent attacks [lij [la] the eavesdropper 
is not restricted at all, i.e. she may interact with all 
signals simultaneously. Already in the year 2005 it was 
shown in [17|, LL8| that for protocols, which are invariant 
under permutations of single-signal states, collective and 
coherent attacks are equivalent in the case of infinitely 
many signals. But for a finite number of signals this 
equivalence has not been proven yet. As a consequence 
the development of tools to compute a secret key for finite 
resources in the presence of coherent attacks is necessary. 

Up to now direct strategies that treat coherent attacks 
only exist for the BB84 [19] protocol (see 03, [U). In 
[101 Tomamichel et al used an uncertainty relation for 
smooth entropies [2(| to circumvent the evaluation of the 
smooth min-entropy by the computation of the smooth 
max-entropy [l| . Since the resulting max-entropy has to 
be evaluated for a classical state, the calculation becomes 
analytically solvable. 

In comparison to these direct strategies, many studies 
have focused on indirect approaches like post-selection 
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21] or the de Finetti approach 0, [22| to quantify se- 
cret key rates, where the analysis for coherent attacks 
is traced back to the investigation of collective attacks. 
In 0, these indirect approaches have been compared to 
each other for the BB84 protocol with the result, that the 
post-selection technique exceeds the de Finetti approach 
in terms of secure key rates. 

In this paper we present a new strategy to calculate 
secret key rates for general permutation-invariant (i.e. 
the output of the protocol remains the same under per- 
mutations of the input pairs) protocols for coherent at- 
tacks. In particular, we relate the secret key rate for 
coherent attacks to the calculation of secret key rates for 
collective attacks by bounding the smooth min-entropy 
of a permutation-invariant state via the min-entropy of 
a corresponding tensor-product state "smoothed" over 
a reduced environment. We compare the results to the 
post-selection technique by applying the AEP-bound for 
the treatment of collective attacks. Note that most of 
the protocols studied in the literature already fulfill the 
condition of permutation-invariance or can made to be 
permutation- invariant, like e.g the BB84 and six-state 
[H [H protocol. 

The paper is organized as follows. In Section [H] we 
explain the protocol and fix the notation. We clarify the 
formalism used to calculate secret key rates under the 
assumption of collective attacks in Section Mil The for- 
malism to analyze coherent attacks, the main result of 
this paper, is presented in Section |IV] Section W\ shortly 
reviews the post-selection technique, which is then com- 
pared to the new strategy with respect to secret key rates 
for the BB84 and six-state protocol in Section lVIl Finally, 
Section IVlII concludes the paper. 



II. PRELIMINARIES 

In this paper we consider permutation-invariant 
entanglement-based QKD protocols, which consist of the 
steps: state distribution, sifting, parameter estimation 
(PE), error correction (EC), error verification and pri- 
vacy amplification (PA) (for a detailed description see 
[ItI [l8l|). Here, permutational invariance means that for 
any permutation of the input pairs the output of the pro- 
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tocol remains unchanged. In the following we denote by 
Pab t ne initial state of N signals shared by Alice and 
Bob, and by Pabe a purification of p^ B , which describes 
the state shared by Alice, Bob and Eve after the state 
distribution. Now, let Nab be the operation, that rep- 
resents the procedures, which Alice and Bob perform on 
their states, i.e. measurement, sifting, parameter estima- 
tion, error correction and error verification. (Note that 
privacy amplification is not included here, since the out- 
put of this procedure is the final bit-string used as key.) 
Then we define the resulting classical-quantum state con- 
taining Alice's bit string and Eve's quantum state as 
Pxe '■— (Nab <8> 1b) Pabe- As tne mam quantity for 
the calculation of secret key rates we use the smooth 
min-entropy [l[ 

H Lin (pae\E) := sup sup H min (<j A e\pe) , 

(1) 

defined as an optimization of the min-entropy 

H min {°ae\pe) ■= sup {A e R : 2- A l A ® p E - <tae > 0} 

(2) 

over an | -environment given by 



B* (p) :-- 



£ 

1^2 



(3) 



with the 1-norm \\A\\ 1 = tr (^AA^. S(U E ) denotes the 
set of density operators on the Hilbert space %e- 



III. COLLECTIVE ATTACK 

In contrast to coherent attacks, the assumption of col- 
lective attacks forces the eavesdropper Eve to interact 
with each of the signals separately. Under this restric- 
tion the distributed state can for permutation-invariant 
protocols be regarded as a product state Pab> which is 
diagonal in the Bell- basis [13, Gil • We denote by m the 
number of randomly chosen signals used for parameter 
estimation and by n the remaining number of signals for 
privacy amplification. Then, the rate of an e-secure key 
can be quantified in the following way. 

Theorem 1. [S] Let £pe, £ec, £pa, £ > and let p x n E = 
{Nab <8> Is) Pabe ^ e a tensor-product state for a purifi- 
cation pabe in'H.ABE of the state pab G S(Hab)- Then 
the rate of an e co n := (epe + £ec + £pa + e)- secure key 
is given by 



:=I inf 

N PAB er c 



EC I 



-^!og 2 (2£pa) 
(4) 



The smooth min-entropy of the classical-quantum 
state p® E shared by Alice and Eve and the correction 
2 log 2 (2epa) arise from the analysis of privacy amplifica- 
tion. The entropy quantifies Eve's uncertainty of Alice's 
bit-string. 



The term leaksc stands for the number of bits which 
Alice and Bob leak to the eavesdropper due to public 
communication during the error correction procedure and 
cost for the error verification. In total, the leakage can 
be estimated by d, Hoj 



leakEc 



nl.lH(X\Y)+\og 2 (—). 

\£ec/ 



(5) 



Here, the factor 1.1 denotes the efficiency of a specific 
error-correction protocol used during the key-generation. 
The minimization of the smooth min-entropy is due to 
parameter estimation, where we only except qubit-states 
Pab which are contained in the set [Io| 



Tcoii ; — { gab 



-IIP -P 

2 II J in J n 



li < H e PE,n,m) \ (6) 



with 



£(£pe,71,to) := 



(n + m)(m + 1) In (1/spe) 



8m 2 r 



(7) 



This means, that the tolerated quantum bit error rate 
(QBER) P m due to an m-fold independent application of 
a POVM £ on a tensor-product state is £-close to the pa- 
rameter P n , which corresponds to a virtual measurement 
on the remaining n signals, which are used for the key 
generation, except with probability £pe (see Lemma[5]in 
the Appendix). Note that this estimate has been devel- 
oped in [lOj for coherent attacks, i.e. Lemma |6] holds for 
permutation-invariant states. As tensor-product states 
in collective attacks are permutation- invariant, Lemma [B] 
can be applied. 

For product states p^ E we can use the asymptotic 
equipartition property (see Eq. (|B7|) ) to bound the 
smooth min-entropy by the conditional von Neumann en- 
tropy of a single copy Pxe- Finally, we get for the rate 
of an £ co n := (eps + £ec + £pa + e)-secure key: 



r C oll '■= TT 



inf ( S(X\E) 



leak E c 



log 2 (2/e) 



N 



log 2 (2e PA ) 



where 



S(X\E) = S(pxe) - S{p E ) 



(8) 



(9) 



with S(p) := — tr (plog 2 p). 

In the next section we present a formalism to treat 
coherent attacks. We will see that the analysis of secret 
key rates for coherent attacks can be traced back to the 
calculation of secret key rates under the assumption of 
collective attacks (see Eq. ©). 



IV. COHERENT ATTACK 

A coherent attack is the most general attack an eaves- 
dropper can perform, i.e. Eve is not restricted at all. For 
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the investigation of secret key rates for coherent attacks, 
we have to consider non-product states for the evalua- 
tion of the smooth-min entropy. No changes are needed 
in the analysis of parameter estimation for collective at- 
tacks (see Eq. (J6j) ) , because it also holds for coherent 
attacks (i.e. non-product states (see Lemma |6] in the 
Appendix)). Since error correction and error verifica- 
tion are also independent of the underlying attack of the 
eavesdropper (they are purely classical procedures), the 
protocol analysis for these steps can be adopted from the 
one for collective attacks. 

For permutation-invariant protocols it has been shown 
in pjj and [l8[ that we can assume w.l.o.g. that, after 
the distribution of N qubit pairs, Alice and Bob share a 
permutation-invariant quantum state, which is a convex 
combination of tensor-products of Bell-states: 

Pab = Vn ( J2 Mn<r? ni ® ® ® <" 4 J 

VneA™ / 

(10) 

with probabilities /Lt„ for the "realization" n and the set 
of realizations 



A 



N 



n = (711,712,713,714) : 



N 



(11) 



i=i 



The <Ti for i = 1,..,4 correspond to the projector onto 



the 4 Bell-states 


in Ha £ 


D Hb, i.e. 




o-i = 
0-2 = 
C3 = 
o- 4 


!</;+> 


with 






|^> 


1 


(|00) ± |11)) 




1 

' V2 


(]01> ± |10» 



(12) 

and (13) 
(14) 



'P/v denotes the completely positive map (CPM) which 
symmetrizes the state with respect to all possible distin- 
guishable permutations of the N qubit pairs. 

The following section explains the analysis of pa- 
rameter estimation for permutation-invariant states (see 
Eq. (0). 



A. Parameter estimation 

Let the sifting procedure now be such that N s = n + m 
signals remain, where m denotes the number of randomly 
chosen signals used for parameter estimation and n de- 
notes the remaining number of signals for privacy am- 
plification. Then we can adopt Lemma [6] to estimate 
the QBER Q n by the tolerated QBER Q m coming from 
a measurement on general permutation-invariant states 
(see also the arguments below Eq. |J7|)). 



Theorem 2. Let £pe > and m + n = N s . Let 

Pab £ "5 ^H®g s j be a permutation-invariant quantum 
state, and let £ be a POVM on 1-Lab which measures 
the QBER. Let Q m and Q„ be the frequency distri- 
butions when applying the measurement £® m and £® n , 
respectively, to different subsystems of p^h- Then for 
any element Q m and Q n from Q m and Q„ except with 
probability £pe 



\\Q m - Qnlli < £(epE,rc,m.) 



(15) 



with £(epe, 7i, m) := 



_ d / (TO+n)(m+l)ln(l/ep E ) 



Proof: This follows directly from Lemma [6] in the Ap- 
pendix, which is a consequence of [Toj | . □ 

Now with the definition of the set of states, which pass 
the parameter estimation procedure 

: ^ \\Qm - Qnlli < f (ep E ,7i,m)| , (16) 



1 EPE ■= i V AB 



we are able to give an analytic expression for the rate of 
an e-secure key for coherent attacks. 

Corollary 1. Let £pe, £ec, £pa, £ > and let p\ E — 

{Nab ® Is) Pabe be a permutation-invariant state for 
a purification p ABE in H ABE of p^ B g S (H^b) ■ Then 
the rate of an e co h := (epe + £ec + £pa + e) -secure key is 
given by 



r := - n inf (H s min (p n XE \E) - leak EC ) 

JV PAB el e PE 



N 



log 2 (2e PA ) 
(17) 



In the following section we show that the smooth min- 
cntropy for permutation-invariant states can be mainly 
bounded by the min-entropy for corresponding product- 
states "smoothed" over a reduced e -environment. 



B. Privacy amplification 

In order to get a calculable formula for the key 
rate (Eq. (|17p ) we bound the smooth min-entropy for 
permutation-invariant states by the smooth min-entropy 
for tensor-product states, which then can be easily evalu- 
ated by the asymptotic equipartition property (Eq. (|B7[) ) 
as explained in Section IHII 

We now define analogously to Eq. (fTo|) the 
permutation-invariant state with n signals, which Alice 
and Bob share after the parameter estimation procedure. 

Pab ■= V n t J2 ^ a ? ni ® ^ ® ^ ® CT 4 " 4 J , 

VnGA" / 

where <7j with i — 1,..,4 correspond to the projec- 
tors onto the 4 Bell-states in Ha ® Hb and A™ := 
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jn = (rii, n 2 , n 3 , n 4 ) : X)i=i n « = n } ( see Ec l- CHI))- Ad- 
ditionally, we denote the single-copy state shared by Alice 
and Bob in the following as 



CAB [A] := 



(19) 



withA:=(A 1) A 2 ,A 3 ,A 4 ) = (^,^ ! ^,^). 

The next theorem is one of our central results. 
It gives a relation between the smooth min-entropy 
for permutation-invariant states and the smooth min- 
entropy for tensor-product states. The proof is inspired 
by [3 and uses the fact, that there exists a certain mea- 
surement on (jabW^™, such that the resulting state is 
equal to the state p n AB for a specific realization n. Then, 
the application of some fundamental properties of the 
smooth min-entropy leads to the result. 

Theorem 3. Let e > 0, X = (2i 2a 2a 24) and 

7 \ n 1 n 1 n 1 n J 

Mab be the quantum operation which describes the lo- 
cal measurements Alice and Bob perform followed by 
a partial-trace operation on Bob's part (Kb)- Let 

Pxe = (M-ab ® Ifi) 8 " Pabe be the classical quan- 
tum state obtained after applying the quantum opera- 
tion (Mab ® He)®" on a purification p\ BE in 'H'abe 
of a permutation-invariant state p AB € S {H\b) • Anal- 
ogously let a XE [X]® n = (Mab <8 1e)®" o- A B E [X]® n 
be the classical quantum state obtained after applying 
the quantum operation (Mab ® 1b)* 8 ™ on a purifica- 
tion o~ABE[X]® n of a tensor-product state <7/lb[A]®" € 
S {%%)■ Let £ be a POVM on U A ® Hb which mea- 
sures the QBER. Let Q n , P n be an element of the fre- 
quency distribution Q n , P„ of the outcomes when apply- 
ing the measurement £® n to p n AB and cr AB , respectively. 
Then except with probability e 



HLn ( Pxe \e)>h\ 



where 



•:/(2„ 2 ) 



X = 



n 



F -1, (20) 



coh 



tab 



||Qm--Pn|li<£coh(e,n,mn (21) 



with 

S,coh (e,n,m) := - 
where 

^ att (e,2,n) 



Ut (e,2,n)+e(|,! 



,n,m := 



16 In (2) +81n(l/e) 



(m + n)(m + 1) ln(2/e) 
8m 2 n 



(22) 



(23) 



(24) 



defines the set of tensor-product states r® n which pass 
the parameter estimation procedure. 



Proof: The state to be considered is given by p XE and 
can be expressed as a convex combination of states for 
all possible realizations n with probability /z n , i.e. 



Pxe = WkN' 



(25) 



n£A" 



Note that this structure is provided in Eq. (|T8|) and is 
conserved due to the linearity of Mab and a purification 
of p AB , which is optimal for Eve. 

The first part proves the theorem for the special case, 
that only one [i n in Eq. (|25p is non-zero, i.e. we consider 
a single realization n. Then, part 2 extends part 1 to the 
general case. 

Part 1: 

Let \<j>i) be an extension to Ha <8> Hb ® rl E of o~i (see 
Eq. (|18p) with the condition, that the remaining states 
tr ab (-P|0i>) are mu tually orthogonal for i G {1,..,4}. 
Note that this choice of orthogonal ancillas is optimal, 
since it enables the eavesdropper to distinguish perfectly 
the reduced states shared by Alice and Bob. Let S n be 
the set of distinguishable permutations ir on n qubits for 
a fixed realization n. Then, with 



'ABE 




and 



) ABE 



i=l 



we define 



p XE [n] := {M A B®^ E )® n P m 
a XE [X] := {Mab ® 1e) P W \ be 



(26) 



(27) 



(28) 
(29) 



for an arbitrary, but fixed realization n. For any i £ 
{1,..,4} let Pi be the projector onto the support of 
(M (E> 1_e) P\4>i) which by definition are orthogonal for 
distinct i. Let J be a measurement defined by 



F:p^Y,FzpFt®\z) (z\, 



z=0 



where 



(30) 



(31) 



and Ft := TL — Fq. Then Fo picks out a specific realization 
n from the tensor-product state cr X E[X]® n , i.e. 



PxeW = 



1 



Pz{Z = 0) 



F (<T XE {X\® n ) F% (32) 



with P Z (Z = 0) = tr (f (<t®£[A]) Fj) = nti A? 
(For a detailed proof see [l~8|, Lemma A4). 
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Now let p XEZ [n] be the resulting state after applying 
T on cr^[A] and let Z be the classical measurement 
outcome, i.e. 

1 

PxezH = Y. F *°Te\Mf1®\z){z\ (33) 

z=0 
1 

=: W = *We'[*] ® \z) (z\ ■ (34) 



Then it follows directly from Eq. that 



p n XE [n] = pMf°[n] 



(35) 



and therefore 

HLn [PxeHW) = H s min (fc z £*[n]\E) . (36) 

With some fundamental properties of the smooth min- 
cntropy we get 



HLn (PX Z E=>}\E) 



' ' H^ Z - ^ (p XEZ [n]\EZ) 



Eg. J23 

> 

Eq. EB 



H%i Z - m (pxezHE) - log 2 (rank(^)). 



(37) 



By definition, the orthogonality and completeness of the 

411 



set {F z } ensures that tiz (PxEz[ n ]) = such that 



we can apply Eq. (|A2[) in the Appendix. This leads to 
(PxezME) ~ !og 2 (rank(p z )) 



TjPz(Z=0)e f - n 
min 



Eq. \A2 



> H. 



pz(Z=0)e I _®n 



{oT E [\\\E)-\o^ (rank(^)) 



(38) 



where we used in the last step that rank(p^) < 2 and 
from Lemma [7] in the Appendix that 



PZ (Z = 0) = \S n \Y[\^ > 1/r 



(39) 



The following part generalizes the proof to the unre- 
stricted case. 
Part 2: 

Now let p n ABE ■— Pu,\ with 



E 

n£A" 



I ABE 



(40) 



be a purification of p n AB . For any n € A™ let Hj| be 
the smallest subspace of containing the support of 
the traces p^[n] = tr w ®« (p^ BB [n]). By the definition 

of the vectors as in part 1, the subspaces are 
orthogonal for distinct n G A™. There exists a projective 
measurement T' onto the subspaces H® B ®T-L E . Now let 



the state p XB z' be the resulting state from the measure- 
ment T' of the state p XE and let Z' £ A™ be the classical 
outcome, i.e. 



PxEZ> = E ® I") ("I ( 41 ) 

ngA" 

=: E WxeW ® |n) <n| . (42) 



n£A" 



By the definition of the state we know that for a tol- 
erated QBER Q m the parameter Q n for a virtual mea- 
surement on n signals has to fulfil except with probability 
I that 



2 HQ™ - Qnlli < £ (|' n ' TO ) • 



(43) 



Note that the choice of | is arbitrary. In princi- 
ple, the introduction of a new parameter could lead 
to better results. Now, this condition implies that re- 
alizations n in the permutation-invariant state p\ B = 
SneA™ P-nPAB [ n ] > whose corresponding parameter Q n 
does not fulfill the condition in Eq. (|4"3"|). only appear 
with small probability, i.e. more precisely 



E 



e 

Pn < 7T- 



(44) 



This behaviour of the probabilities enables us to apply 
Eq. (|A6|) in the Appendix for probability e' — § to re- 
strict the states p\ B [n] (or equivalently their correspond- 
ing realizations n) to the set 



1 g/2 — 



Namely, we have 



(45) 



H min (Pxe\ E ) 

Eq. J2U 

> H^ in (PxEZ'\EZ') 



Eq. \A6l 

> 



inf. fl^feWlB). (46) 



Then Eq. (gBJl becomes, together with Eq. ([55]). Eq. (JSTJ) 
and Eq. J35}, 

inf. fl2£0& B [n]|25) 

^ B ["] £r f/2 

> ^f. H^(a%[\= ~]\e) - 1 

(47) 

Since the min-entropy is now a function of a tensor- 
product state, we would like to express the restricting in- 
fimum in terms of the statistics P„ of this tensor-product. 
By definition, we have p^- B [n] = a XE [\ = £], suc h that 
we can apply Lemma[S]in the Appendix (for k = N = n), 
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which states that, except with probability e, the statistics 
P„ of the tensor-product state ir|g[A — ^] is £ at t-close 
to Q„, i.e. 

~||Q»-P»Hi <Ut(e,\£\,n). (48) 

(Here the choice of £ is arbitrary. The consideration of 
a new parameter could in general lead to better results.) 
Now, we are able to bound the distance between P n and 
the tolerated QBER Q m measured during parameter es- 
timation by using the triangular inequality. 



2 ||Qm ^nlll — 2 WQ Tl 



\ . fatt (£,2,n) 
n.m) H 



Mi 

=: Ccoh(£,«,™) 



(49) 



where we used that for the POVM applied for parameter 
estimation (see Eq. ([5]) and Section HV Ap the number of 
POVM elements becomes 2 (see @|) and that j|| 



WQr 



P\\ <--IIQ 

r n\\i — 2 2 "^ r ' 



(50) 



Consequently we end up in 

inf. flSS te?) (aSJ[A=Sp 



> inf 



6/(2 



.(gin 



If 



(51) 



The assertion then follows by putting Eq. (|51l) and 
Eq. gZ]) into Eq. (gBJ}. □ 
Finally, we are able to formulate a calculable rate of 
an e co h-secure key for coherent attacks. 

Theorem 4. Let £pe, £ec, £pa, £ > and /ei p\ E = 
{Nab ® 1b) Pabe be a permutation-invariant state for 
a purification Pabe * n ^-abe °f Pab ^ ^ ("H®g ) . TTien 



i/ie rate of an e co h := (epe + £ec 
is given by 



^coh 



n 
N 



inf S(X\E) 
PAser coh V 



pa + 2e) -secure key 
leak E c \ 



log 2 (4n 2 /e) 



1 

N ' 

where 

Tcoh = Y?AB '■ j 
with 

£ coh (e, n, m) : 



N 



log 2 (2ep A ), 



(52) 



||Qm - -Pnlli < Ccoh (e,n,m) > (53) 



£ att (e, 2, n) 



•f(|,n,ro) (54) 



/or 



Catt(£,2,n) := 



(m + n)(m + l)ln(2/e) 



8m 2 ? 



161n(2) + 8rn(l/e) 



and 



S(X|£) = S(p XB ) - S(p B ) 
-tr (plog 2 p). 



, (55) 



(56) 



(57) 



Proof: The proof follows by inserting the result from 
Eq. ((201) into Eq. ([17]) and using Eq. (|B7|) to express the 
smooth min-cntropy of product states by the conditional 
von Neumann entropy of a single-copy state. □ 

A careful analysis of the proof of Eq. (|2"0|) enables us 
to obtain the main corrections for the secret key rate 
for coherent attacks (Eq. (1521) ) in comparison to collec- 
tive attacks (Eq. ([8])): First, for coherent attacks the 
probability to measure a single realization n for a given 
tensor-product state is rather small, which makes the e- 
environment, e.g. in Eq. (|51j) small. Second, the statis- 
tics for the different attacks are not identical in general. 
Additional fluctuations have to be taken into account 
as done by considering £ a tt (see Eqs. ([54]) and (|56|)). 
These corrections loose their corrupting influence on the 
secret key rate, when considering the asymptotic limit 
(N — s- oo, e — >• 0). In this case £ a tt becomes zero and no 
additional fluctuations have to be added to the QBER, 
thus the corrections vanish. This confirms the equiva- 
lence of collective and coherent attacks for permutation- 
invariant protocols stated in [Tt], [3 in the asymptotic 
limit. But for a finite number of signals these corrections 
have a dramatic impact on the secret key rate. And, since 
these additional terms seem unavoidable, this might be a 
hint, that the equivalence of collective and coherent at- 
tacks might not hold for permutation-invariant states in 
the regime of finite resources. 

The following section shortly reviews the known post- 
selection technique 21], which we then will compare to 
Eq. ([52]). 



V. POST-SELECTION - A SHORT REVIEW 



In order to determine the quality of r co h (Eq. (152]) ) 
from the previous section, we have to compare it to key 
rates obtained by strategies existing in the literature. Up 
to now, there exist two main techniques to quantify secret 
key rates for finite resources for coherent attacks for the 
whole class of permutation-invariant protocols, namely 
the de Finetti approach [jj, |22| and the post-selection 



technique [21 



Since Sheridan et al showed in Q that 
the latter technique leads to higher secret key rates, we 
only take the post-selection technique for comparison. 

The post-selection technique applied to QKD estimates 
the deviation of the finite key rate r pos t obtained from a 
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permutation-invariant protocol against coherent attacks 
from the corresponding rate r co n against collective at- 
tacks. The rate of an e post -secure key is given by [Il[ 



r P ost = fcoji - 30 log 2 (N + l)/N 



(58) 



where r co u is given by Eq. (|5J| evaluated for the security 
parameter e col i = e post (N + l) -15 . 



VI. COMPARISON 



In this section we compare our newly developed se- 
cret key rate r co h (Eq. (|52p) and the known rate r pos t 
(Eq. ([55)0 for coherent attacks to the secret key rate 
evaluated under the assumption of collective attacks r co ii 
(Eq. (JHJ) for the BB84 protocol and the six-state proto- 
col. 

The finite-key rates are calculated for a total secu- 
rity parameter of e := e con = e post = e co h = 10~ 9 . 
In the following let QBER := Q m denote the tolerated 
QBER from the POVM used for parameter estimation 
(see Eq. © and Section WK\ . 

The results are obtained from a numerical optimization 
procedure, which maximizes the key rate with respect to 
the parameters m, E, £pe, £ec, £pa- 

In FIG. [T]the secret key rates are shown as a function 
of the initial number of signals N for different QBERs for 
the BB84 protocol. FIG. [5] presents an analogous calcu- 




FIG. 1: (Color online) Comparison of the secret key rates r co n 
(Eq. ©) (black circles), r post (Eq. I|58|ll (green squares) and 
r co h (Eq. (|52|)) (red triangles) versus the number N of initial 
signals for different QBERs with security parameter e = 1CP 9 
for the BB84 protocol in logarithmic scale; QBER = 0.01 
(straight lines), QBER = 0.1 (dotted lines). 

lation for the six-state protocol. Note that, as mentioned 
m Section iFVBl in both cases we recover the known re- 
sult that coherent attacks become collective attacks in 




FIG. 2: (Color online) Comparison of the secret key rates r co n 
(Eq. Q) (black circles), r post (Eq. lj58|) (green squares) and 
fcoh (Eq. (|52l) ~) (red triangles) versus the number N of initial 
signals for different QBERs with security parameter e = 10 -9 
for the six-state protocol in logarithmic scale; QBER = 0.01 
(straight lines), QBER = 0.1 (dotted lines). 



the limit of infinitely many signals N. For finite N the 
figures show that the new rate r co h is always significantly 
higher in comparison to the rate r post obtained from the 
post-selection technique. This advantage of r co h can be 
seen for a rather small QBER = 0.01 as well as for a 
high value QBER = 0.1. For example we obtain that 
the increase of r co h in comparison to r pos t is around 43% 
for a QBER of 0.01 (TV = 10 6 ) and 33% for a QBER 
of 0.1 (N = 10 10 ) for the BB84 protocol. In case of the 
six-state protocol r co h exceeds r post by around 51% for a 
QBER of 0.01 (N = 10 6 ) and 45% for a QBER of 0.1 
(N = 10 8 ). 



VII. CONCLUSION 

In this paper we presented a new method to quantify 
the rate of a secret key for general permutation-invariant 
protocols for coherent attacks. We show a technique to 
trace the calculation of secret key rates for coherent at- 
tacks back to the analysis of collective attacks. The high 
quality of this method manifests itself by a comparison 
to the up to now best-known strategy, the post-selection 
technique. For the treatment of collective attacks we ap- 
plied the von Neumann entropy bound. We showed that 
for a finite number of initial signals the secret key rates 
for the BB84 and the six-state protocol obtained by our 
method exceed the rates coming from the post-selection 
technique significantly. In case of the BB84 protocol, 
higher secret key rates have been obtained in [l(| and 
ll| by a specialized method, which can, however, not be 
applied to the six-state protocol. Our method, in con- 
trast, can be applied to all permutation-invariant quan- 
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turn key distribution protocols for which an analysis of 
collective attacks is available. Since our results strongly 
depend on the underlying analysis of collective attacks, a 
prospective progress in the analysis of collective attacks 
will automatically cause a progress in our strategy with 
respect to secret key rates. 

Additionally the results of our derivation confirm the 
known result that, in the limit of infinitely many initial 
signals, coherent attacks are as powerful as collective at- 
tacks. Furthermore, we point out the main impact on 
the corrections for the key rate against coherent attacks 
in comparison to collective attacks. Since this extensive 
impact seems unavoidable, this might give some evidence 
for the inequivalence of the two types of attacks for finite 
resources. 

Since the assumption of permutation-invariance is 
fairly weak (most protocols used in the literature are 
permutation-invariant or can be made to), the results 
of this paper can be widely applied. 
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Appendix A 
1. Properties of the (smooth) min-entropy 

Lemma 1. Let p ABZ := J2zez p z( z )Pab ® \ z ) ( z \ e 
S (Ha <8> Hb <8> Hz) be a classical-quantum state with 
Pab = tr z (pabz) and <j B € S (H B ), then 

H^ n ( P abz\B) > H e min (p AB \B) . (Al) 

Proof: For any v > there exists pab € B? (pab) 
such that for any a B 

H min (PAbWb) > H^ in (pabWb) ~ V. 

Then it follows with Eq. (jB4)) that 

#mm (PABzWb) > # min (PAbWb) ■ 

To conclude the proof it suffices to verify that Pabz G 
(pabz)- 

2 Wpabz - PabzWi < 2 Wpab - Pab\\i < 

where we used the fact that the trace-distance cannot 
increase when applying a quantum operation (see [![, 
Lemma A2.1). The assertion then follows by choosing 
gb such that 

H< Un (PabWb) = H^ in (pab\B) 



and the fact that 

H min (PABZ\B) > H min (paBzWb) ■ 

□ 

Lemma 2. Let pab € S (Ha ® Hb), {\ z )} z a family of 
orthogonal vectors in Hz and e > 0. Then for a state 
Pabz := Y.,zzF*PabFI ® \z) (z\ with J2 zeZ F*F z = 1 
and tr z (pabz) = PAB 

Kun (pab\B) < (pabz\B) . (A2) 

Proof: From the definition of pabz it follows immedi- 
ately that 

H £ min iPz (Pabz) \B) = H* min ( PAB \B) . 
Then the assertion follows with Lemma [T] 

tffnin (trz (Pabz) \B) < H e min (pabz\B) . (A3) 

□ 

Lemma 3. Let pab € S(Ha®Hb), {\ z )} z a family 
of orthogonal vectors in Hz and e > 0. Then for a 
state pabz ■= Y^zez p z( z = z ) p z PabF'} ® \z) (z\ with 
J2zez F 'z F 'z = 1 and tr z (pabz) = PAB 

Kun (pab\B) > ff* in (pabz\BZ) . (A4) 

Proof: From the definition of pabz it follows immedi- 
ately that 

Kin ( tr * (Pabz) \B) = H e min ( PAB \B) . 

Then the assertion follows from the strong subadditivity 
of the smooth min-entropy (see Eq. JB3|), i.e. 

H £ min (tr z (pabz) \B) > H s min (p ABZ \BZ) . (A5) 

□ 

Lemma 4. Let p A BZ = J2zez p z( z )Pab ® \ z )( z \ be a 
classical quantum state and s,s' > 0, then for any subset 
Z' C Z such that Prob[z G Z'\ > 1 - e' , 

H S J:' (pabz\BZ) > inf H s min (p\ B \B) . (A6) 

z£Z' 

Proof: For any v > and z € Z' there exists p z AB £ 
23 2 (p AB ) sucn that for any a B 

H min (PabWb) > H e min (p\ B \o z B ) - v. 

Let 

PABZ := P ^( Z )PAB ® \z)(z\. 

zGZ' 

Then it follows with Eq. (JB2J) that 

H min (pABz\<JBz) = inf H min (p z AB \a B ) 

> ^H^Mb\°b)-v- 
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To conclude the proof it suffices to verify that pabz G 

e+e' 

B 2 (p ABZ ). 



Eq. 



1 II- 

2 WPabz — PabzWi 

E p 7> ,( y z )\ WPab - Pab\\\ 
zez' 

+ E p z\v( z )l 

z£Z\Z' 



< 



< 



2 IIPabIIi 



ZG.Z 

e+e' 



The assertion then follows by choosing a B such that 

KuniPABWh) = Kin (PAb\B) 

and the fact that 

H min (PABZ\BZ) > H min (paBzWbz) ■ 



□ 



Lemma 5. Let p ABZ = J2zez p z( z )Pab ® 6e 

classical quantum state and e z := Pz(z)s, then 

H% iD (p ABZ \BZ) < H e min (p AB \B) . (A7) 

Proof: For any j/ > and z ^ Z there exists p' ABZ G 
(pabz) such that for any crg^ 

#min (PABzksz) > (PABzWbz) ~ V. 

Then it follows with Eq. (JB5J that 

#min (PAsks) > #™ in (^Bzksz) - V. 

To conclude the proof it suffices to verify that p' AB G 
BHpab)- 



2 



Eq. 



2 IIpabz - PabzWi 

Pz ^l^AB ~ PABWl 



> P^\\p1b-P%b\\x- 
The assertion then follows by choosing o~ BZ such that 

H min {PABzWbz) = H^ in (p A Bz\BZ) 

and the fact that 

^min (PAB\B) > H min {PabWb) ■ 



2. Estimation of frequency distributions 

Lemma 6. Let e PE > and < k < N. Let p N G 

S {H® N ^j be a permutation-invariant quantum state, and 
let £ be a POVM on % which measures the quantum bit 
error rate (QBER). Let Qk and Qn-u be the QBERs 
when applying the measurement £® k and£® N ~ k , respec- 
tively, to different subsystems of p N . Then except with 
probability epE it holds that 

\WQN-k-QkWx <£{e-PE,N-k,k) (A8) 



with £(epE, N — k,k) := ^ 



jV(fc+l)ln(l/£ PE 
8k 2 (N-k) 



Proof: It follows from the supplementary in- 
formation (Note 2) of 10] that with £pe := 



Prob[Q n >Q k + 2e(e PE , N - k, k)] < e PE . (A9) 

The assertion then follows by negation of the statement. 

□ 



3. Multinomial distribution 
Lemma 7. Let n G N and Aj = ^ for i — 1, ..,4 with 



11* > * 



(A10) 



for n > 500. 

Proof: After applying the logarithm we get 

4 \ 4 



In 



JjA^ =ln(n!)-^ln(n i !)+n i ln(-). 

i=l / i=l ' " 

(All) 



By using the Stirling-formula 



/ 2Tm(-) < nl < ( 1 + — !— ) V2nn 

\e) \ lln \e 



(;)" < A12 » 



we get for n > 



4 

In (n!)-^ln (rn!)+nj In (— ) 

i=l 71 
1 ( 4 1 

> - In (27m) - E 9 ln ^ 27r "^ + 1 

\i=l 

= _i M2 ™)_g;^) +ta ( 1 + _L)) 



□ 



> -|ln(2™)-41n(H) ; 



(A13) 
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where we used in the last line that i In f^-J < and 
In (l + -^j < In (1 + ±) for m > V« = 1, .., 4. After 
exponentiation we end up in 

I 4 1 /ii \ 4 i 



n 



ni!n2!n3!n4! 



i=i 



(27m) 3 / 2 Vl2 



which holds for n > 500. 



□ 



Appendix B: Known results 

Here, we review known results, which are crucial for 
derivations in the paper. 

1. Properties of the (smooth) min-entropy 

• Chain rule (see [lj, Theorem 3.2.12): Let pabc € 
S (H A <8> H B ® H c ) and e > 0. Then for p c = 

tr AS (PABC) 

(pabc\B) < H s miD (pabc\BC) + log 2 (rank (p c )). 

(Bl) 

• Conditioning on classical information (see [l[ , The- 
orem 3.2.12): Let p A BZ ■= Y^zez p z( z )Pab ® 
\z) (z\ G S (Ha <8> Hb <8> Hz) a classical-quantum 
state, then 

H min (pabz\BZ) = inf iJ min (pab\B) • (B2) 

z^Z 

• Strong subadditivity (see [l|. Theorem 3.2.12): Let 

Pabc € 5 ("Ha ®Hb® He) and e > 0, then 

tffnin (Pabc \BC) < H^, m (p AB \B) . (B3) 

• Partial-trace operation on classical subsystem can 
only decrease min-entropy (see [l|, Lemma 3.1.9): 

Let pabz ■= T,zez p z(z)p A B ® \ z ) ( z \ € 
S (Ha®Hb ®Hz) be a classical-quantum state 
with pab = tr z (pabz) and er B G 5 (%b), then 



#min (PABzlCTis) > fl^ (pAsks) ■ (B4) 

• Quantum operations can only increase min-entropy 
(see lU, Theorem 18): Let p AB G S(H A ®H B ) 



and let £ be a quantum operation such that pac 
(1a<8)£)pab, then 



H^ n (pAc\C)>H^ n (p AB \B). 



(B5) 



Trace-distance of mixtures (see [l|, Lemma A.2.2): 

Let paz :=E, e 2 P z(^)PA®l z ) ( z l e S (H A <8 Hz) 
be a classical-quantum state and an analogous def- 
inition for p^4^, then 



\ Wpaz ~ PazIIi = P ^ z )\ 



\Pa~Pa\ 



(B6) 



zez 



• Smooth min-entropy of quantum tensor-procluct 
states (see [l|, Corollary 3.3.7): Let p% n E G 

s((Hx®H E )® n ) a classical-quantum tensor- 
product state and e > 0, then 

K*» (pTe\E) > n (s(X\E) - 5^^) , (B7) 

where S(X|.E) = S(pxb) - S(p E ) with S(p) := 
-tr (plog 2 p). 



2. Estimation of frequency distributions 

Lemma 8. fH \Mj Let e att > and < k < N. 

Let p N G S (H® N ) be a permutation-invariant quantum 
state, and let £ and T be POVMs on H with \£\ and 
\J-\ outcomes, respectively. Let Qf and Q^_ fe be the fre- 
quency distribution of the outcomes when applying the 
measurement £® k and J?® N ~ k t respectively, to different 
subsystems of p N . Finally, let Q, be any convex set of 
density operators such that, for any operator A on n — 1 
subsystems, the normalization o/tr„_i (l <£> Ap n \ ® An 
is contained in Q. Then except with probability e a tt; there 
exists a state a G such that 



k 1 M „ 
N2^ 



Pfl 



N-kl 
N 2 



77 I iQjV-fe 



<Ut(e a tt,\£\ + \F\,N) 



(B8) 



where P^, P^-fc denote the probability distributions 
of the outcomes when measuring a with respect to 
£ and T, respectively and £ a tt(£att> \£\ + 1-^li-W") := 



81n(2)(|£| + |^|)+81n(l/e att ) 
N 
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